Integrated circuits (IC's) for applications such as smartcards, RFID tags, Pay-TV chips often contain a secret security key and carry out secret functions. The IC needs to be secure against attacks from the outside which aim at retrieving data there from. IC's may be subjected to both front-side as well as backside attacks. In this description the “front-side” of a semiconductor device is defined as the side of the semiconductor device on which circuitry is provided. This side is also being referred to as the “first side of the substrate” in this description. Likewise, the “backside” of the semiconductor device is defined as the side opposite to the front-side and this side is also being referred to as the “second side of the substrate” in this description. Backside attacks may consist of various analysis techniques such as light or photon emission detection, thermal infrared detection, liquid crystal detection, voltage or electric field detection, and electro magnetic detection methods. Often these methods are used in combination with invasive attacks such as wafer thinning, laser cutting and heating, focused ion beam (FIB) techniques. Also light or laser flash methods are used from the backside in order to force signals to flip. When any one of the above-mentioned techniques is used in combination with mathematical attacks, these attacks can be very powerful. Because a lot of the earlier-mentioned techniques are done from the backside of the IC, it is essential that the backside of these IC's are well protected.
WO 03/046802 A2 discloses a semiconductor device comprising a circuit that is covered by a passivation layer. It is provided with a first security element that comprises a local area of the passivation layer and which has a first capacitance. Preferably, a plurality of security elements is present, having different capacitances. The semiconductor device further comprises measuring means for measuring an actual value of the first capacitance, and a memory comprising a first memory element for storing the actual value as a first reference value in the first memory element. The semiconductor device of the invention can be initialized by a method wherein the actual value of the capacitance is stored as the first reference value. An attempt to tamper the passivation layer can be detected by comparison of the actual value measured again and the first reference value.
A disadvantage of the known semiconductor device is that it does not provide for backside protection. Moreover, the protection technique implemented in this device may not easily be manufactured using conventional backside processing techniques, as it requires a special passivation structure comprising a special passivation layer and measurement electrodes for measuring a capacitance or inductance whose values are determined by the passivation layer. For backside processing this constitutes quite a complex solution.